mirror of
https://github.com/kata-containers/kata-containers.git
synced 2025-05-03 22:17:35 +00:00
tests: k8s: rename hard-coded policy test script
Rename k8s-exec-rejected.bats to k8s-policy-hard-coded.bats, getting ready to test additional hard-coded policies using the same script. Signed-off-by: Dan Mihai <dmihai@microsoft.com>
This commit is contained in:
parent
7b691455c2
commit
3e348e9768
tests/integration/kubernetes
@ -12,16 +12,16 @@ setup() {
|
|||||||
hard_coded_policy_tests_enabled || skip "Policy tests are disabled."
|
hard_coded_policy_tests_enabled || skip "Policy tests are disabled."
|
||||||
|
|
||||||
get_pod_config_dir
|
get_pod_config_dir
|
||||||
pod_name="policy-exec-rejected"
|
pod_name="hard-coded-policy-pod"
|
||||||
pod_yaml="${pod_config_dir}/k8s-policy-exec-rejected.yaml"
|
pod_yaml="${pod_config_dir}/k8s-policy-hard-coded.yaml"
|
||||||
allow_all_except_exec_policy=$(base64 -w 0 "${pod_config_dir}/allow-all-except-exec-process.rego")
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@test "Kubectl exec rejected by policy" {
|
@test "Kubectl exec rejected by policy" {
|
||||||
# Add to the YAML file a policy that rejects ExecProcessRequest.
|
# Add to the YAML file a policy that rejects ExecProcessRequest.
|
||||||
|
allow_all_except_exec_policy=$(base64 -w 0 "${pod_config_dir}/allow-all-except-exec-process.rego")
|
||||||
yq -i \
|
yq -i \
|
||||||
".metadata.annotations.\"io.katacontainers.config.agent.policy\" = \"${allow_all_except_exec_policy}\"" \
|
".metadata.annotations.\"io.katacontainers.config.agent.policy\" = \"${allow_all_except_exec_policy}\"" \
|
||||||
"${pod_yaml}"
|
"${pod_yaml}"
|
||||||
|
|
||||||
# Create the pod
|
# Create the pod
|
||||||
kubectl create -f "${pod_yaml}"
|
kubectl create -f "${pod_yaml}"
|
@ -41,7 +41,6 @@ else
|
|||||||
"k8s-empty-dirs.bats" \
|
"k8s-empty-dirs.bats" \
|
||||||
"k8s-env.bats" \
|
"k8s-env.bats" \
|
||||||
"k8s-exec.bats" \
|
"k8s-exec.bats" \
|
||||||
"k8s-exec-rejected.bats" \
|
|
||||||
"k8s-file-volume.bats" \
|
"k8s-file-volume.bats" \
|
||||||
"k8s-inotify.bats" \
|
"k8s-inotify.bats" \
|
||||||
"k8s-job.bats" \
|
"k8s-job.bats" \
|
||||||
@ -56,6 +55,7 @@ else
|
|||||||
"k8s-optional-empty-secret.bats" \
|
"k8s-optional-empty-secret.bats" \
|
||||||
"k8s-pid-ns.bats" \
|
"k8s-pid-ns.bats" \
|
||||||
"k8s-pod-quota.bats" \
|
"k8s-pod-quota.bats" \
|
||||||
|
"k8s-policy-hard-coded.bats" \
|
||||||
"k8s-policy-job.bats" \
|
"k8s-policy-job.bats" \
|
||||||
"k8s-policy-pod.bats" \
|
"k8s-policy-pod.bats" \
|
||||||
"k8s-policy-pvc.bats" \
|
"k8s-policy-pvc.bats" \
|
||||||
|
@ -6,7 +6,7 @@
|
|||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: Pod
|
kind: Pod
|
||||||
metadata:
|
metadata:
|
||||||
name: policy-exec-rejected
|
name: hard-coded-policy-pod
|
||||||
spec:
|
spec:
|
||||||
terminationGracePeriodSeconds: 0
|
terminationGracePeriodSeconds: 0
|
||||||
shareProcessNamespace: true
|
shareProcessNamespace: true
|
Loading…
Reference in New Issue
Block a user